Comment by pixl97

You should add an additional rule that another 1/3 of the time will need added on maintenance for the 1/3rd of the time spent on new features.

1/3 = adding new features.

1/3 = maintaining the security posture of the application and keeping it up to date.

1/3 = spent figuring out why the new features blew up in the field after passing all testing.